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REMARKS 

The Examiner has rejected Claims 1-24 under 35 U.S. C. 102(e) as being 
anticipated by Le Pennec et al. (U.S. Patent No. 6,976,271). Applicant respectfully 
disagrees with such rejection, especially in view of the amendments made hereinabove to 
each of the independent claims. Specifically, applicant has amended the independent 
claims to at least substantially include the subject matter of dependent Claim 2. 

With respect to the independent claims, the Examiner has relied on Col. 9, line 10 
- Col. 10, line 27; Col. 12, lines 43-64; Col. 13, lines 49-57; Col. 14, lines 44-59; and 
Col. 15, lines 17-26 from the Le Pennec reference to make a prior art showing of 
applicant's claimed "comparing said one or more attributes determined from said 
computer file with corresponding stored attributes of said specific known malware free 
computer file (sec this or similar, but not necessarily identical language in the 
independent claims). 

Applicant respectfully asserts that the excerpts from Le Pennec relied upon by the 
Examiner merely disclose that "[a] Certificate is associated with this file on the File 
Server (103)" where "[t]he Certificate indicates that the file has been processed by a list 
of anti-virus programs (also referred to as anti-virus checkers), and is virus free " (Col. 7, 
lines 43-47 - emphasis added). Further, Le Pennec discloses that "[e]ach file is identified 
by its characteristics (303), which can be one or a combination of the following 
information: the source system which has originated the file, the file name , the file type , 
optionally, the file size , [and] optionally, the file CRC (a file signature)" (Col. 10, lines 
40-46 - emphasis added). Additionally, Le Pennec discloses that " the anti-virus criteria 
associated with the file . . . [is retrieved (402)] from the Virus-free Certificate Rules Table 
(403)" where '[s]aid record is identified using its " File Source ", " File Name ", and 

" File Type " fields, and using information retrieved from the received file (its name, its 

type, and its source which is typically identified by the IP address of the system which 
originated the file)' (Col. 12, lines 43-53 - emphasis added). 
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However, the mere disclosure of using file characteristics such as source system, 
file name, file type, file size, and file CRC to identify the file in order to retrieve the anti- 
virus criteria associated with the file, as in Le Pennec, fails to suggest "comparing said 
one or more attributes determined from said computer file with corresponding stored 
attributes of said specific known malware free computer file " (emphasis added), as 
claimed by applicant. Thus, using the file characteristics to identify the file , as in Le 
Pennec, fails to even suggest "corresponding stored attributes of said specific known 
malware free computer file " (emphasis added), in the manner as claimed by applicant. 

Further, with respect to the independent claims, the Examiner has relied on Col. 9, 
line 10 - Col. 10, line 27; Col. 12, lines 43-64; Col. 13, lines 49-57; Col. 14, lines 44-59; 
and Col. 15, lines 17-26 from the Le Pennec reference to make a prior art showing of 
applicant's claimed technique "wherein if said attributes match, then confirming said 
computer file as being said specific known malware free computer file." 

Applicant respectfully asserts that the excerpts from Le Pennec relied upon by the 
Examiner merely disclose that "[a] Certificate is associated with this file on the File 
Server (103)" where "[t]he Certificate indicates that the file has been processed by a list 
of anti-virus programs (also referred to as anti-virus checkers), and is virus free " (Col. 7, 
lines 43-47 - emphasis added). Further, Le Pennec discloses that "[e]ach file is identified 
by its characteristics (303), which can be one or a combination of the following 
information: the source system which has originated the file, the file name , the file type , 
optionally, the file size , [and] optionally, the file CRC (a file signature)" (Col. 10, lines 
40-46 - emphasis added). Additionally, Le Pennec discloses that " the anti-virus criteria 
associated with the file . . . [is retrieved (402)] from the Virus-free Certificate Rules Table 
(403)" where '[s]aid record is identified using its " File Source ", " File Name ", and 
" File Type " fields, and using information retrieved from the received file (its name, its 
type, and its source which is typically identified by the IP address of the system which 
originated the file)' (Col. 12, lines 43-53 - emphasis added). 
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However, the mere disclosure of using file characteristics such as source system, 
file name, file type, file size, and file CRC to identify the file in order to retrieve the anti- 
virus criteria associated with the file, as in Le Pennec, fails to suggest a technique 
"wherein if said attributes match, then confirming said computer file as being said 
specific known malware free computer file " (emphasis added), as claimed by applicant. 
Thus, retrieving the anti-virus criteria only after using the file characteristics to identify 
the file, as in Le Pennec, simply cannot meet "wherein if said attributes match , 
confirming said computer file as being said specific known malware free computer file " 
(emphasis added), in the manner as claimed by applicant. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
Co.868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the above reference, as noted above. 
Nevertheless, despite such paramount deficiencies and in the spirit of expediting the 
prosecution of the present application, applicant has amended each of the independent 
claims to further distinguish applicant's claim language from the above reference, as 
follows: 

"wherein said identifying code is operable to compare a file name, and a 
storage location of said computer file with a corresponding file name, and storage 
location of said specific known malware free computer file" (see this or similar, 
but not necessarily identical language in the independent claims). 

Applicant respectfully asserts that Le Pennec discloses that VC Cache Table 
comprises a table with a list of records having a File section (Col. 16, lines 1-9). Further, 
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Le Pennec discloses that the File section contains a "File Name," which "is the name of 

the file. . . [and is] the explicit file name," a "File Type," which "is the type of the file," 

a "File Size," which "is the size of the file," and a "File CRC," which "is the CRC (a 

file signature) of the file" (Col. 16, lines 12-21). In addition, Le Pennec discloses that 
"[t]he combination of File Name and File Type may identify in a unique way one 
file ," and "[i]f multiple files have the same name and type . . .each one of these said file 
may then be differentiated in a unique way by its file size " (Col. 16, lines 22-26 - 
emphasis added). Furthermore, Le Pennec discloses that "[il f multiple files have the 
same name, type, and size , each one of these said file is then differentiated in a unique 
way by its file CRC which is a file signature (hashing)" (Col. 16, lines 29-31 - emphasis 
added). 

However, the mere disclosure of identifying and differentiating files based on 
combinations of file name, file type, file size and file signature, as in Le Pennec, simply 
fails to even suggest a technique "wherein said identifying code is operable to compare a 
file name , and a storage location of said computer file with a corresponding file name, 
and storage location of said specific known malwarc 1'rcc computer file " (emphasis 
added), as claimed by applicant. Clearly, the mere suggestion of using a file signature to 
identify and differentiate between files with the same name, type, and size, as in Le 
Pennec, clearly fails to even suggest using a "file name, and a storage location," in the 
manner as claimed by applicant. 

Again, the foregoing anticipation criterion has simply not been met by the above 
reference, as noted above. Thus, a notice of allowance or specific prior art showing of 
each of the foregoing claim elements, in combination with the remaining claimed 
features, is respectfully requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 25-30 below, which are added for full consideration: 
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"wherein said storage location of said computer file is a known storage 
location or a relative storage location" (see Claim 25); 

"wherein said relative storage location is determined by a configuration 
setting" (see Claim 26); 

"wherein said corresponding file name, and storage location of said 
specific known malware free computer file are stored within a malware signature 
file" (see Claim 27); 

"wherein said stored attributes of said specific known malware free 
computer file are stored within a malware signature file" (see Claim 28); 



"wherein further malware detection processing is performed upon said 
computer file if said computer file is not identified as potentially being one 
specific known malware free computer file from among a plurality of specific 
known malware free computer files" (see Claim 29); and 

"wherein said identifying code, said determining code, said comparing 
code, and said further malware detection processing are performed by a malware 
scanner" (see Claim 30). 



Again, a notice of allowance or a proper prior art showing of all of applicant's 
claim limitations, in combination with the remaining claim elements, is respectfully 
requested. Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 



In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 100. The 
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Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P491/03.025.01). 



Respectfully submitted, 
Zilka-Kotab, PC. 

/KEVINZILKA/ 

Kevin J. Zilka 

P.O. Box 721 120 Registration No. 41,429 

San Jose, CA 95172-1120 

408-505-5100 



